T09 · Insecure Skill Coding Practices
Error
- Location
- server.py:248
- Finding
- Unrestricted Colony Endpoint Polling Enables Blind SSRF## Vulnerability Details **File Location**: `server.py:248-313` **Vulnerability Type**: Server-Side Request Forgery (SSRF) **Risk Level**: High The server accepts an arbitrary colony endpoint, stores it without validation, and later issues an HTTP GET request to that endpoint from the server's network context. ```python @mcp.tool() def colony_register(name: str, colony_type: str, endpoint: str = "", metadata: str = "{}") -> dict: """Register a new external colony. Args: name: Colony name colony_type: Colony type endpoint: Connection address metadata: Additional JSON metadata """ TYPE_MAP = { "hive": "Another hive", "flower_field": "Data source", "manuka_grove": "Specialist knowledge", "river": "Streaming information", } if colony_type not in TYPE_MAP: return {"error": f"Invalid type {colony_type}"} db = get_db() now = datetime.now(timezone.utc).isoformat() try: meta = json.loads(metadata) except json.JSONDecodeError: meta = {} db.execute( "INSERT OR REPLACE INTO colonies " "(name, type, endpoint, status, last_poll, metadata) " "VALUES (?, ?, ?, 'registered', ?, ?)", (name, colony_type, endpoint, now, json.dumps(meta, ensure_ascii=False)) ) db.execute( "INSERT INTO evolution_log " "(action, target, detail, created_at) VALUES (?, ?, ?, ?)", ( "colony_register", name, json.dumps( {"type": colony_type, "endpoint": endpoint}, ensure_ascii=False ), now ) ) db.commit() db.close() return { "registered": name, "type": colony_type, "display": TYPE_MAP[colony_type], "endpoint": endpoint, } @mcp.tool() def colony_poll(name: str) -> dict: """Probe the status of an external colony.""" db = get_db() row = db.execu ...[truncated 3306 chars]
- Remediation
- ## Remediation Suggestions 1. Permit only explicitly required URL schemes, preferably `https`. 2. Maintain an explicit allowlist of approved destination hostnames and ports. 3. Resolve destination hostnames before making requests and reject every address that is loopback, private, link-local, reserved, multicast, or unspecified. 4. Explicitly block known cloud metadata destinations, including link-local metadata addresses. 5. Disable redirects unless necessary. If redirects are required, resolve and validate every redirect target before following it. 6. Protect against DNS rebinding by connecting only to the validated resolved address while preserving the intended TLS hostname. 7. Apply outbound firewall or proxy rules so the process cannot reach loopback, private networks, or metadata services unless explicitly required. 8. Require authorization for colony registration and polling operations. 9. Return a generic failure status rather than exception-type and HTTP-status distinctions that improve the network-scanning oracle. 10. Add tests covering encoded IP addresses, IPv6, redirects, user-info URL syntax, alternate ports, mixed-case schemes, and DNS rebinding scenarios.